Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft

A tampered version of the Claude Code extension for Cursor was available in the Cursor VS Code extension marketplace on Thursday for about eleven hours, affecting up to 5,000 users, according to Cursor. The extension tried to harvest data such as hostname, username, operating system and public IP address, and attempted to set up remote access for the attacker, which Cursor says likely wouldn't have worked on most machines since it requires admin privileges. Cursor pulled the extension and took the entire marketplace offline, then reinstated it after working with providers to neutralize the malware and confirming no further risk, saying no other extensions were affected.